{"id":548,"date":"2025-12-23T11:42:43","date_gmt":"2025-12-23T10:42:43","guid":{"rendered":"https:\/\/www.hardwaresecurity.it\/?p=548"},"modified":"2025-12-23T11:42:43","modified_gmt":"2025-12-23T10:42:43","slug":"potaebox-the-lost-pentest-dropbox","status":"publish","type":"post","link":"https:\/\/www.hardwaresecurity.it\/?p=548","title":{"rendered":"POTAEbox: The Lost Pentest Dropbox"},"content":{"rendered":"\n

One of my biggest regrets during the last years is that I have never got enough time to continue a side project that I care(d) quite a lot: POTAEbox. What\u2019s it? It\u2019s a Pentest Dropbox, in particular, it stands for Penetration Over The Air & Ethernet box.<\/p>\n\n\n\n

\"aPNG\"<\/figure>\n\n\n\n

The plan was to create some prototypes to check if the idea works and then move into the R&D phases: SoCs evaluation and procurement, features gathering, PCB design, etc. Eventually between a new baby in the family, new responsibilities at work, COVID & the famously-hated chip shortage\u2026 everything got delayed.<\/p>\n\n\n\n

Anyway, for sake of sharing some good tech know-how and hoping this article will be of inspiration for some hacker out there\u2026 here I am writing a small tutorial on how to build such kind of pentest dropbox. Of course, it is not an exhaustive walkthrough, but it gives enough insights on what usually I place inside a pentest dropbox (except for the 3G\/4G modem to callback safely with an OOB covert channel).<\/p>\n\n\n\n

First of all, here a small recap of the major prototypes I have developed in the past 15 years of pentests. The first and second generation were made with not-so-optimized piece of hardware (i.e. they were bulky and expensive).<\/p>\n\n\n\n

\"bPNG\"<\/figure>\n\n\n\n

Then, around 2016 it happened the revolution. From China started to pop-up many SBCs (Single Board Computers) with the perfect form-size that allowed to fit them into small COTS cases. This led me to start purchasing and evaluating many SBCs (if not all of them). as you can see in the image below.<\/p>\n\n\n\n

\"cPNG\"<\/figure>\n\n\n\n

In the image below you can see one of my favorite COTS cases: a Powerline adaptor created by DEVOLO. This commercial device (i.e. Devolo Duo), once stripped of the original internal PCBs, allows to fit a small USB 5V 2A power supply and one of those Chinese SBCs (i.e. NanoPi, OrangePi, etc).<\/p>\n\n\n\n

\"djpg\"<\/figure>\n\n\n\n
\"fpng\"<\/figure>\n\n\n\n
\"epng\"<\/figure>\n\n\n\n

At this point, you already have an acceptable Pentest Dropbox that can be placed into the premises of your target. Of course, it has the bare minimum functionality (i.e. once connected into the target\u2019s LAN can callback your C2 through the target network over Iodine & AutoSSH). This approach of course has all disadvantages of the case, right Purple Teamers?! But is also a good starting point to check how secure (i.e. NAC, 801.x, SIEM, NIDS, etc) is the LAN and if the SOC has proper detection and response capabilities. <\/p>\n\n\n\n

Another approach to get a more powerful POTAEbox, was to move from one COTS case to another. For this new prototype I was looking for something more spacious to allow more features in it, in particular I wanted to be able to do:<\/p>\n\n\n\n